4 ms·

It looks like google parse the page serverside to detect break out of frames scripts. Here's a manually engineered example - I searched for a demo of a break ou

by user24 16y ago

It looks like google parse the page serverside to detect break out of frames scripts. Here's a manually engineered example - I searched for a demo of a break out of frames script and forced the URL into a google images request: http://images.google.com/imgres?imgurl=http://www.internet.com/icom_includes/footers/img/icom_logo_qsfooter.png&imgrefurl=http://javascript.internet.com/navigation/manual-frame-break-demo.html&usg=__nA7P9hJ3tihz2fLto_VlTZ96K2M=&h=891&w=883&sz=234&hl=en&start=1&itbs=1&tbnid=IYlLzX-w4vX2AM:&tbnh=146&tbnw=145&prev=/images%3Fq%3Dfoo%26hl%3Den%26gbv%3D2%26tbs%3Disch:1 http://images.google.com/imgres?imgurl=http://www.internet.c... THe page just displays a "you are being redirected" message straight away, so it must be detected at the server level. Smart.

user24 16y ago
Having said that, if you look at a genuine result from twitter: http://images.google.com/imgres?imgurl=http://a1.twimg.com/profile_images/108462666/home_sscredits_bigger.jpg&imgrefurl=http://twitter.com/homeproject&usg=__gzb2ICTasTI-R6GrhHpOIfNxoVs=&h=3780&w=2835&sz=442&hl=en&start=1&itbs=1&tbnid=_uftMx2399b4tM:&tbnh=150&tbnw=113&prev=/images%3Fq%3Dsite:twitter.com%26hl%3Den%26gbv%3D2%26tbs%3Disch:1 http://images.google.com/imgres?imgurl=http://a1.twimg.com/p... google doesn't detect or stop that breaking out of frames. But maybe twitter are just managing to avoid detection by google's code.. The code on that page is: <script type="text/javascript"> //<![CDATA[ if (window.top !== window.self) {document.write = "";window.top.location = window.self.location; setTimeout(function(){document.body.innerHTML='';},1);window.self.onload=function(evt){document.body.innerHTML='';};} //]]> </script> which doesn't seem like it would be too hard to detect.